Add RootFS license/NOTICE candidate review results

.github/workflows/ci.yml

@@ -40,6 +40,7 @@ jobs:
           ruby -c Scripts/rootfs-license-review.rb
           ruby -c Scripts/rootfs-license-review-results.rb
           ruby -c Scripts/rootfs-license-notice-candidates.rb
+          ruby -c Scripts/rootfs-license-notice-review-results.rb
           ruby -c Scripts/prepare-rootfs-license-review.rb
           ruby -c Scripts/prepare-rootfs-license-notice-bundle.rb
           ruby -c Scripts/rootfs-source-acquisition.rb
@@ -50,17 +51,20 @@ jobs:
           ruby -c Tests/Scripts/RootFSLicenseReviewResultsTests.rb
           ruby -c Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb
           ruby -c Tests/Scripts/RootFSLicenseNoticeBundleTests.rb
+          ruby -c Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb
           ruby -c Tests/Scripts/RootFSSourceBundleTests.rb
           bash Tests/Scripts/RuntimeSmokeScriptTests.sh
           bash Tests/Scripts/RootFSCandidateSmokeManifestTests.sh
           ruby Tests/Scripts/RootFSLicenseReviewTests.rb
           ruby Tests/Scripts/RootFSLicenseReviewResultsTests.rb
           ruby Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb
           ruby Tests/Scripts/RootFSLicenseNoticeBundleTests.rb
+          ruby Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb
           ruby Tests/Scripts/RootFSSourceBundleTests.rb
           ruby Scripts/prepare-rootfs-license-review.rb --validate-only
           ruby Scripts/rootfs-license-review-results.rb
           ruby Scripts/rootfs-license-notice-candidates.rb
+          ruby Scripts/rootfs-license-notice-review-results.rb
           ruby Scripts/prepare-rootfs-license-notice-bundle.rb --validate-only
           ruby Scripts/prepare-rootfs-source-bundle.rb --validate-only
 

CHANGELOG.en.md

@@ -41,6 +41,11 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   origins. It indexes 8 remote license/attribution payloads, 46 aports files,
   and the 21 existing evidence files for complete re-verification without
   committing payloads or opening engineering, legal, or redistribution gates.
+- `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree
+  verifier. All 75 candidate payloads now have checksum-bound engineering
+  review; `apk-tools` and `pax-utils` have no remaining candidate-material
+  engineering items, six origins still need package-specific material, and
+  legal and redistribution gates remain closed.
 - arm64 Simulator and unsigned-device final-link gates for the full Experimental graph.
 - Repository iOS 18 native smoke covering 17 preparation, boot, guest, 8 MiB sustained binary-output, stdout/stderr overflow, command, cancellation, recovery, shutdown, and 256 MiB Simulator lifecycle peak-memory checks.
 - A repository-external, unapproved RootFS double-build candidate path for the

CHANGELOG.md

@@ -37,6 +37,10 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引
   8 份远端许可证/attribution 材料、46 份 aports 文件与 21 份既有证据，支持完整
   复验，但不提交 payload，也不解除工程、法律或再分发门禁。
+- 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器；
+  75/75 个候选 payload 已完成 checksum-bound 工程复核，`apk-tools`、
+  `pax-utils` 的候选材料工程项关闭，另外 6 个 origin 仍需补逐包材料，法律和
+  再分发门禁保持关闭。
 - 加入完整 Experimental graph 的 arm64 Simulator 与 unsigned device final-link gate。
 - 加入 repository-owned iOS 18 native smoke App 和 runner，覆盖 17 项 prepare、boot、guest、8 MiB 持续二进制输出、stdout/stderr 超限、command、取消、recovery、shutdown 与 256 MiB Simulator 生命周期峰值内存门禁。
 - native smoke 新增仓库外、未授权 RootFS 双构建候选入口：校验候选 provenance、

Compliance/RootFS/v0.3.3/EVIDENCE.json

@@ -44,7 +44,9 @@
     "sourceOriginsWithRemainingLicenseReviewItems": 8,
     "indexedLicenseNoticeCandidateOrigins": 8,
     "pinnedRemoteLicenseNoticePayloads": 8,
-    "supplementalAportsCandidateFiles": 46
+    "supplementalAportsCandidateFiles": 46,
+    "engineeringReviewedLicenseNoticeCandidatePayloads": 75,
+    "sourceOriginsWithRemainingCandidatePayloadReviewItems": 6
   },
   "engineeringStatus": {
     "completeInstalledPackageInventory": true,
@@ -55,7 +57,7 @@
     "licenseCandidateEngineeringReviewCompleted": true,
     "completeLicenseNoticeCandidateBundleIndex": true,
     "licenseNoticeCandidatePayloadCommitted": false,
-    "licenseNoticeCandidateEngineeringReviewApproved": false,
+    "licenseNoticeCandidateEngineeringReviewCompleted": true,
     "completeLicenseAndNoticeBundle": false,
     "correspondingSourceBundleCollected": false,
     "redistributionApproved": false

Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json

@@ -33,6 +33,8 @@
   "indexedOpenSourceOrigins": 8,
   "pinnedRemoteReferencePayloads": 8,
   "supplementalAportsFiles": 46,
+  "engineeringReviewedCandidatePayloads": 75,
+  "sourceOriginsWithRemainingCandidatePayloadReviewItems": 6,
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,
   "engineeringReviewCompleted": true,

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json

@@ -0,0 +1,174 @@
+{
+  "schemaVersion": 1,
+  "archive": {
+    "version": "v0.3.3",
+    "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
+  },
+  "candidateManifestSha256": "55e13487c9c0b0ad0160e91c440120b6faa1ef75b0cf467676c67834ca1083cb",
+  "status": "candidate-payloads-engineering-reviewed-open-release-gates",
+  "engineeringReviewCompleted": true,
+  "allIndexedCandidatePayloadsReviewed": true,
+  "referenceLicenseTextsReviewed": true,
+  "completePackageLicenseNoticeSetPresent": false,
+  "legalReviewApproved": false,
+  "redistributionApproved": false,
+  "candidatePayloadTreeFormat": "sha256-path-lines-v1",
+  "candidatePayloadTreeSha256": "a54935ff29aa4f9784a74f26733bd915f8e6750e8487138af3f17a9389b93d30",
+  "reviewedPayloadFileCount": 75,
+  "reviewedClosedOriginEvidenceCount": 4,
+  "sourceOriginsWithRemainingReviewItems": 6,
+  "sources": [
+    {
+      "sourceOrigin": "alpine-baselayout",
+      "declaredLicenseExpressions": [
+        "GPL-2.0-only"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "partial",
+      "reviewedExistingEvidenceCount": 1,
+      "reviewedReferenceLicenseCount": 1,
+      "reviewedSupplementalAportsCount": 0,
+      "reviewedRemoteEvidenceCount": 1,
+      "resolvedReviewItems": [
+        "collect-complete-gpl-2.0-license-text"
+      ],
+      "remainingReviewItems": [
+        "identify-package-specific-copyright-and-notice"
+      ],
+      "engineeringConclusion": "additional-package-material-required"
+    },
+    {
+      "sourceOrigin": "alpine-keys",
+      "declaredLicenseExpressions": [
+        "MIT"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "reference-only",
+      "attributionCoverage": "partial",
+      "reviewedExistingEvidenceCount": 1,
+      "reviewedReferenceLicenseCount": 1,
+      "reviewedSupplementalAportsCount": 0,
+      "reviewedRemoteEvidenceCount": 0,
+      "resolvedReviewItems": [],
+      "remainingReviewItems": [
+        "collect-mit-license-grant-and-copyright-notice"
+      ],
+      "engineeringConclusion": "additional-package-material-required"
+    },
+    {
+      "sourceOrigin": "apk-tools",
+      "declaredLicenseExpressions": [
+        "GPL-2.0-only"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "complete",
+      "reviewedExistingEvidenceCount": 2,
+      "reviewedReferenceLicenseCount": 1,
+      "reviewedSupplementalAportsCount": 2,
+      "reviewedRemoteEvidenceCount": 0,
+      "resolvedReviewItems": [
+        "confirm-package-specific-attribution-and-aports-patch-notices"
+      ],
+      "remainingReviewItems": [],
+      "engineeringConclusion": "candidate-material-complete-engineering-only"
+    },
+    {
+      "sourceOrigin": "busybox",
+      "declaredLicenseExpressions": [
+        "GPL-2.0-only"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "partial",
+      "attributionCoverage": "partial",
+      "reviewedExistingEvidenceCount": 3,
+      "reviewedReferenceLicenseCount": 1,
+      "reviewedSupplementalAportsCount": 36,
+      "reviewedRemoteEvidenceCount": 0,
+      "resolvedReviewItems": [
+        "confirm-aports-patch-notices"
+      ],
+      "remainingReviewItems": [
+        "review-bundled-third-party-license-and-attribution-coverage"
+      ],
+      "engineeringConclusion": "additional-package-material-required"
+    },
+    {
+      "sourceOrigin": "ca-certificates",
+      "declaredLicenseExpressions": [
+        "MPL-2.0 AND MIT"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "partial",
+      "reviewedExistingEvidenceCount": 2,
+      "reviewedReferenceLicenseCount": 2,
+      "reviewedSupplementalAportsCount": 0,
+      "reviewedRemoteEvidenceCount": 0,
+      "resolvedReviewItems": [
+        "collect-complete-mpl-2.0-license-text",
+        "confirm-mit-script-notices-relevant-to-shipped-bundle"
+      ],
+      "remainingReviewItems": [
+        "confirm-certificate-attribution-and-trust-store-requirements"
+      ],
+      "engineeringConclusion": "additional-package-material-required"
+    },
+    {
+      "sourceOrigin": "musl",
+      "declaredLicenseExpressions": [
+        "MIT",
+        "MIT AND BSD-2-Clause AND GPL-2.0-or-later"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "partial",
+      "reviewedExistingEvidenceCount": 5,
+      "reviewedReferenceLicenseCount": 3,
+      "reviewedSupplementalAportsCount": 3,
+      "reviewedRemoteEvidenceCount": 0,
+      "resolvedReviewItems": [],
+      "remainingReviewItems": [
+        "confirm-third-party-musl-files-and-aports-helper-notice-coverage"
+      ],
+      "engineeringConclusion": "additional-package-material-required"
+    },
+    {
+      "sourceOrigin": "openssl",
+      "declaredLicenseExpressions": [
+        "Apache-2.0"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "partial",
+      "reviewedExistingEvidenceCount": 2,
+      "reviewedReferenceLicenseCount": 1,
+      "reviewedSupplementalAportsCount": 5,
+      "reviewedRemoteEvidenceCount": 1,
+      "resolvedReviewItems": [],
+      "remainingReviewItems": [
+        "confirm-required-apache-notice-and-attribution-material"
+      ],
+      "engineeringConclusion": "additional-package-material-required"
+    },
+    {
+      "sourceOrigin": "pax-utils",
+      "declaredLicenseExpressions": [
+        "GPL-2.0-only"
+      ],
+      "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "complete",
+      "reviewedExistingEvidenceCount": 1,
+      "reviewedReferenceLicenseCount": 1,
+      "reviewedSupplementalAportsCount": 0,
+      "reviewedRemoteEvidenceCount": 1,
+      "resolvedReviewItems": [
+        "confirm-package-specific-copyright-and-aports-patch-notices"
+      ],
+      "remainingReviewItems": [],
+      "engineeringConclusion": "candidate-material-complete-engineering-only"
+    }
+  ]
+}

Compliance/RootFS/v0.3.3/NOTICE.md

@@ -43,12 +43,17 @@ for `libc-dev`, `zlib`.
 8 source origins still have package-specific open
 items, so this is not a complete or legally approved license/NOTICE bundle.
 `LICENSE-NOTICE-CANDIDATES.json` now pins an external candidate bundle for
-those open origins: 8
-remote reference/attribution payloads and
+those open origins: 8 remote
+reference/attribution payloads and
 46 supplemental aports
 files, together with all checksum-bound reviewed evidence. The repository
 tool can materialize and re-verify that bundle outside the repository.
-These collected candidates still require engineering and legal review.
+`LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering
+review of all 75 indexed
+payload files. 2 origins have no remaining
+candidate-material engineering items; 6 origins
+still require package-specific material. Legal review and redistribution
+approval remain open.
 
 ## Corresponding-source status
 

Compliance/RootFS/v0.3.3/README.md

@@ -23,6 +23,9 @@ pinned RootFS archive. It does not store the RootFS payload.
 - `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 8 份远端
   许可证/attribution 材料、46 份 aports 补充文件及现有 21 份复核证据的外置候选包；
   payload 不提交，工程、法律和再分发门禁保持关闭；
+- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 75 个 payload 文件树的
+  工程复核结果；2 个 origin 的候选材料工程项关闭，6 个仍需补逐包材料，法律和
+  再分发门禁保持关闭；
 - `RUNTIME-CONFIGURATION.json`：guest、`apk`、repository、world 和 DNS 默认配置；
 - `NOTICE.md`：可复现 attribution inventory 与尚未完成事项；
 - `EVIDENCE.json`：输入成员摘要、数量和明确的工程/发行状态；
@@ -38,8 +41,10 @@ candidates. Two source origins have no remaining indexed review items; eight
 still have package-specific open items. `LICENSE-NOTICE-CANDIDATES.json`
 indexes an external candidate bundle for those eight origins: 8 pinned remote
 license/attribution payloads, 46 supplemental aports files, and the existing
-21 reviewed evidence files. It neither commits those payloads nor approves
-engineering, legal, or redistribution gates.
+21 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the
+engineering review to the exact 75-file payload tree. Two origins have no
+remaining candidate-material engineering items; six still require
+package-specific material. Legal and redistribution approval remain open.
 
 ## 重新生成 / Regenerate
 
@@ -146,6 +151,7 @@ path outside the repository:
 
 ```bash
 ruby Scripts/rootfs-license-notice-candidates.rb
+ruby Scripts/rootfs-license-notice-review-results.rb
 ruby Scripts/prepare-rootfs-license-notice-bundle.rb --validate-only
 
 ruby Scripts/prepare-rootfs-license-notice-bundle.rb \
@@ -157,6 +163,9 @@ ruby Scripts/prepare-rootfs-license-notice-bundle.rb \
   --source-bundle /absolute/rootfs-v0.3.3-source-review \
   --license-review /absolute/rootfs-v0.3.3-license-review \
   --verify /absolute/rootfs-v0.3.3-license-notice-candidates
+
+ruby Scripts/rootfs-license-notice-review-results.rb \
+  --bundle /absolute/rootfs-v0.3.3-license-notice-candidates
 ```
 
 远端材料由固定 URL、字节数和 SHA-256 约束；可选 `--download-cache` 只读取以
@@ -174,15 +183,18 @@ advice, or redistribution approval.
 这些文件不构成完整第三方 LICENSE/NOTICE bundle、经审查的 copyleft
 corresponding-source 交付、法律意见或再分发授权。源码获取清单已完整覆盖固定
 inventory，21 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外
-8 个 source origin 的新候选材料仍需工程/法律复核和包级版权/notice 确认。修改说明、构建完整性、
-源码提供方式、App Store 2.5.2 产品策略和负责人批准仍是发行阻塞项。
+8 个 source origin 的 75 个新候选 payload 已完成 checksum-bound 工程复核；
+`apk-tools`、`pax-utils` 的候选材料工程项已关闭，另外 6 个 origin 仍需补逐包
+版权/notice 材料。修改说明、构建完整性、源码提供方式、法律审查、App Store
+2.5.2 产品策略和负责人批准仍是发行阻塞项。
 
 These files are not a complete third-party LICENSE/NOTICE bundle, reviewed
 copyleft corresponding-source delivery, legal advice, or redistribution
 approval. The acquisition manifest completely covers the pinned inventory and
 all 21 indexed candidates have engineering review results. `libc-dev` and
-`zlib` have no remaining indexed items; eight source origins still need
-engineering/legal review of the newly indexed candidates and package-specific
-notice follow-up. Modification, build
-completeness, source-offer mechanics, legal review, App Store 2.5.2 product
-policy, and authorized approval remain distribution blockers.
+`zlib` have no remaining indexed items. All 75 newly indexed payloads have a
+checksum-bound engineering review; `apk-tools` and `pax-utils` have no
+remaining candidate-material engineering items, while six origins still need
+package-specific copyright/notice material. Modification, build completeness,
+source-offer mechanics, legal review, App Store 2.5.2 product policy, and
+authorized approval remain distribution blockers.

Compliance/RootFS/v0.3.3/SHA256SUMS

@@ -1,9 +1,10 @@
-cae8a2d6049ce8f948fe2e9bb852de2eb3601d287993b885e7e83eb0463f09eb  EVIDENCE.json
-2cfbeb2bf48698cc1f9e2ca22acc90041333cddee31f8dc67c98748949d24544  LICENSE-INVENTORY.json
+69fc3496bb4832d109942f72e81009a4d1774d459f372422263903802c5d3019  EVIDENCE.json
+c12f1bf7d6a83b8e4e549dee0cafe28162d9b7f0ab210af5370503fe72f195ec  LICENSE-INVENTORY.json
 55e13487c9c0b0ad0160e91c440120b6faa1ef75b0cf467676c67834ca1083cb  LICENSE-NOTICE-CANDIDATES.json
+faee5c5c91c7be648ff7772c69167be3056bbb3501e52a7057d208d8fbfa621c  LICENSE-NOTICE-REVIEW-RESULTS.json
 3c7f786d9551d716c2a8b374d8cc63d11a46d67827be2fa0cea73b51b6b92eda  LICENSE-REVIEW-RESULTS.json
 3d483714a09cb2194e1b4af9aef5dfec2fbcfd44c70d521899398a3893f1908a  LICENSE-REVIEW.json
-793f7e9b04896b261593b85878fdaeaabcde4bfacdd5c2340edd7e613c3fd531  NOTICE.md
+39dff7ed584e32bb46559d29ffcff7cef4dc88278de1957383616fd412732a64  NOTICE.md
 4f7f7626f3d0891a29717e4b7932c36004ecc9aac25a4aa104c300aae979e3e1  PACKAGE-INVENTORY.tsv
 dbca9b285015a0d8b1d339a894b4594c9e335cbc2d7f9d5212a41095ae4bd1e1  RUNTIME-CONFIGURATION.json
 8e021cb8c4160c934a0202609691d7a94526cd016f4394a47da6e7a5ab41d0ea  SBOM.spdx.json

Docs/ReleaseCompliance.md

@@ -77,8 +77,10 @@ aports snapshot/upstream distfile 获取清单和仓库外 materializer，并固
 21/21 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source
 origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：8 份远端
 许可证/attribution 材料、46 份 aports 补充文件和全部既有复核证据；工具可在
-仓库外原子生成并复验，但材料尚未通过工程/法律批准。修改与构建完整性、源码
-提供方式和法律审查仍未完成，不能视为完整 NOTICE 或已批准的对应源码交付。
+仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 75 文件 payload
+tree；`apk-tools`、`pax-utils` 的候选材料工程项已关闭，另外 6 个 origin 仍需
+补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成，不能视为完整
+NOTICE 或已批准的对应源码交付。
 
 ## 当前仓库保护
 
@@ -177,6 +179,8 @@ Alpine `apk` 可以下载、安装和执行新增代码。即使初始 RootFS 
 - [x] 对固定的 21 个 license/NOTICE 候选完成 checksum-bound 工程复核。
 - [x] 为剩余 8 个 source origin 建立 checksum-bound 外置候选包索引与可复验
   materializer；payload 不提交且批准门禁保持关闭。
+- [x] 对外置候选包的 75 个 payload 完成 checksum-bound 工程复核并固定结果；
+  2 个 origin 的候选材料工程项关闭，6 个仍需补逐包材料。
 - [ ] 收集 license text 和 NOTICE。
 - [ ] 建立 copyleft corresponding source bundle。
 - [x] 固定 DNS、repository 和 package-manager 默认配置事实。